Bulletin ID: HCSEC-2026-25
Affected Products / Versions:
-
CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2.
-
CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2.
-
CVE-2026-19015: Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2.
-
CVE-2026-19017: Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2.
-
CVE-2026-19016: Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2.
-
CVE-2026-15970: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2.
-
CVE-2026-15972: Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2.
-
CVE-2026-19113: Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2.
All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17.
Publication Date: August 7, 2026
Summary
Consul Community Edition and Consul Enterprise are affected by eight vulnerabilities. CVE-2026-19012 is an authenticated denial of service in the Enterprise-to-Community Edition downgrade path. CVE-2026-19014 is an uncontrolled resource consumption issue in the Connect authorization endpoint that defeats the operator’s cache-disable configuration. CVE-2026-19015 is an uncontrolled resource consumption issue in the Connect CA roots endpoint that defeats the operator’s cache-disable configuration. CVE-2026-19017 is a partial arbitrary file read affecting deployments using the Vault Connect CA provider with JWT or AppRole authentication. CVE-2026-19016 is an authorization bypass in the transaction API that allows session deletion without the required ACL permission. CVE-2026-15970 is an L7 intention authorization bypass affecting services configured with a custom public listener. CVE-2026-15972 is an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. CVE-2026-19113 is an unauthenticated denial of service in several agent HTTP API endpoints. All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17.
CVE-2026-19012: Authenticated denial of service in Enterprise-to-Community Edition downgrade path
Background
The service-router configuration entry type allows operators to define routing rules for services in the Consul service mesh. When an agent is started with the Enterprise-to-Community Edition downgrade mode enabled, Consul applies an additional compatibility check to ensure that config entries do not contain Enterprise-only metadata. This check is part of the Raft finite state machine apply path and runs during log replay as well as live writes.
Details
The compatibility check performed during Enterprise-to-Community Edition downgrade processing did not account for all valid forms of a service-router configuration entry. A valid entry that passes all standard normalization and validation steps could trigger a crash during the downgrade compatibility check, causing the agent to exit. An authenticated caller with config-entry write permission may trigger this condition. In deployments where ACLs are disabled, no token is required. The issue only affects Consul deployments that have enabled the Enterprise-to-Community Edition downgrade mode; deployments that do not use this mode are not affected.
CVE-2026-19014: Uncontrolled resource consumption in the Connect authorization endpoint
Background
Consul’s service mesh uses intentions to control which services are permitted to communicate with each other. The POST /v1/agent/connect/authorize endpoint allows a service proxy to ask the local Consul agent whether a given source service is authorized to connect to a destination service. To reduce the cost of repeated authorization checks, the agent maintains a local intention-match cache. Operators can disable agent-side HTTP caching globally with the http_config.use_cache configuration option, a control introduced as a mitigation for prior denial-of-service issues.
Details
The connect authorization endpoint did not honor the http_config.use_cache setting and continued to use the agent-side intention-match cache regardless of whether the operator had disabled caching. A caller could generate unbounded distinct cache entries through normal use of the endpoint, causing the cache to grow without bound and defeating the intended mitigation. Other intention-query endpoints in Consul correctly gate cache use on the operator’s setting. A caller with service:write permission for the target service may exploit this issue; in deployments where ACLs are disabled, no token is required. Setting http_config.use_cache = false does not mitigate this issue in affected versions.
CVE-2026-19015: Uncontrolled resource consumption in the Connect CA roots endpoint
Background
Consul’s service mesh requires each proxy to trust the current set of Connect certificate authority roots. The GET /v1/agent/connect/ca/roots endpoint returns those roots and uses an agent-side cache to reduce the cost of repeated lookups. Operators can disable agent-side HTTP caching globally with the http_config.use_cache configuration option, a control introduced to mitigate request-driven cache abuse.
Details
The Connect CA roots endpoint did not honor the http_config.use_cache setting and used the agent cache regardless of operator configuration. A remote caller could cause the cache to grow without bound through repeated requests, increasing memory pressure and degrading agent availability. Successful exploitation does not require a valid ACL token. Setting http_config.use_cache = false does not mitigate this issue in affected versions.
CVE-2026-19017: Partial arbitrary file read via Vault Connect CA provider
Background
Consul’s service mesh can use Vault as an external certificate authority for issuing Connect TLS certificates. When this integration is enabled, Consul authenticates to Vault using a configured auth method, which may be JWT, AppRole, or Kubernetes. For the JWT and AppRole methods, Consul reads a credential file from the Consul server’s local filesystem before sending it to Vault as part of the authentication request. The set of directories from which Consul may read these credential files is controlled by an allowlist.
Details
The credential directory allowlist used by certain Vault auth methods was broader than intended. A caller with operator:write permission could update the Connect CA configuration in a way that caused Consul to read a credential file outside the intended scope and forward its contents to Vault as part of an authentication request. This may allow the caller to access sensitive files on the Consul server host that they would not otherwise be permitted to read. This issue affects deployments using the Vault Connect CA provider with the JWT or AppRole authentication method; deployments using the Kubernetes auth method are not affected. Deployments that do not use the Vault Connect CA provider are not affected.
CVE-2026-19016: Authorization bypass for session deletion in the transaction API
Background
Consul sessions are used to coordinate distributed locks, leader election, and service health checks across a cluster. The transaction API allows multiple operations of different types, including session operations, to be applied atomically to the Consul state. Access to Consul resources is governed by its ACL system, which requires callers to hold specific permissions for each operation type.
Details
The transaction handler enforced ACL checks for several operation types but did not include a corresponding check for session deletion operations. The dedicated session API correctly requires session:write permission before permitting a session to be modified or deleted. Because this check was absent from the transaction path, a caller could perform session deletion operations without holding the required permission. Exploitation requires network access to the Consul server RPC port and knowledge of the randomly-generated session ID. Enabling mutual TLS on the RPC port limits unauthenticated exploitation by requiring callers to hold a valid client certificate, but does not fully mitigate the issue for authenticated callers that lack session:write permission. Successful exploitation could disrupt distributed locks, leader election workflows, and service health coordination that rely on sessions.
CVE-2026-15970: L7 intention authorization bypass via custom public listener
Background
Consul’s service mesh uses L7 intentions to enforce access control on HTTP traffic between services, including rules that allow or deny requests based on the request path. Operators may supply a custom inbound Envoy listener configuration for a service using the envoy_public_listener_json proxy configuration option. When HTTP L7 intentions are active, Consul injects the intention enforcement filter into the listener regardless of whether the listener configuration is standard or custom.
Details
When Consul generates xDS configuration for a service using a custom public listener, it injected the L7 intention enforcement filter but did not apply the same HTTP request normalization settings used by standard listeners. As a result, path-based intention rules on custom listeners could be evaluated against requests in a form that allowed them to be bypassed. An authenticated mesh workload that is already permitted to connect to the destination service may exploit this to reach paths that are blocked by a deny intention. Only services configured with envoy_public_listener_json and path-based L7 deny intentions are affected; services using the standard listener configuration are not affected.
CVE-2026-15972: Unauthenticated denial of service via unbounded external gRPC connection acceptance
Background
Consul exposes optional external gRPC and gRPC-TLS listeners for use by service mesh proxies and other API clients. These listeners are separate from Consul’s HTTP/HTTPS and internal RPC listeners. A prior security fix applied per-client connection limits and short handshake timeouts to the HTTP and internal RPC listener paths to address resource exhaustion risks on those surfaces.
Details
The external gRPC and gRPC-TLS listeners did not apply per-source connection limits or a short connection establishment timeout equivalent to those present on Consul’s other listener types. A remote caller could open connections to these listeners in a way that caused the agent to retain resources for each connection before any authentication or request handling occurred. There was no limit on how many such connections a single source could hold simultaneously, allowing an attacker to maintain sustained resource pressure. This does not require a valid gRPC request or ACL token. Deployments that do not enable the external gRPC or gRPC-TLS listeners are not affected.
CVE-2026-19113: Unauthenticated denial of service via unbounded request body processing
Background
Consul agents expose an HTTP API used to register services and checks, and to update the status of health checks. Requests to these endpoints are authorized using Consul’s ACL system. Consul’s HTTP framework applies authorization checks to determine whether the caller’s token permits the requested operation.
Details
Several agent API endpoints processed request content before performing ACL authorization, and no limit was applied to the size of that content. An unauthenticated caller could submit requests that caused the agent to consume memory before any authorization decision was made, even though the requests were ultimately rejected. Deployments that restrict network access to the Consul HTTP API to trusted clients, or that enforce mutual TLS client certificates on the HTTPS listener, reduce the exposure of this issue.
Remediation
Customers should evaluate the risk associated with these issues and consider upgrading to Consul 2.0.3. Enabling mutual TLS on the Consul server RPC port reduces the exposure of CVE-2026-19016 by requiring valid client certificates for RPC access. Consul 2.0.3 also introduce a new limits.grpc_max_conns_per_client configuration option (default 100) that bounds the number of concurrent connections accepted from a single source IP on the external gRPC listeners; restricting network access to those listeners to trusted clients further reduces the exposure of CVE-2026-15972. These releases also introduce a new token_dirs agent startup option that allows operators to define a custom credential directory allowlist for the Vault Connect CA provider that cannot be overridden through the Connect CA configuration API.
Acknowledgement
CVE-2026-19012, CVE-2026-19014, CVE-2026-19015, CVE-2026-15970, and CVE-2026-15972 were reported to HashiCorp by Erichen. CVE-2026-19017 was reported to HashiCorp by Kai Aizen / SnailSploit (“The Jailbreak Chef”). CVE-2026-19016 was reported to HashiCorp by Andres Cruciani. CVE-2026-19113 was reported to HashiCorp by Yazdan Soltani.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.